Your GitHub repository has a workflow that needs to create issues in the repository. The workflow is triggered by pull requests from forks. What is the most secure way to authenticate the workflow?

Use the GITHUB_TOKEN with 'issues: write' permission.

Use a personal access token (PAT) from a maintainer account stored as a repository secret.

Create a GitHub App with issues write permission and install it on the repository.

Use a fine-grained PAT with issues write permission stored as an environment secret.

Your team uses GitHub Actions to deploy to Azure. The workflow needs to authenticate to Azure to create resources. You want to avoid storing long-lived secrets in GitHub. What should you use?

An Azure DevOps service connection with a PAT.

A GitHub personal access token stored as a GitHub secret.

A GitHub App with an Azure service principal and use OIDC token exchange.

A GitHub Actions GITHUB_TOKEN with Azure CLI commands.

Which statement correctly describes a system-assigned managed identity?

It is created independently and can be assigned to multiple resources.

It can be used across multiple Azure subscriptions.

It is tied to a single Azure resource and is deleted when that resource is deleted.

It requires manual rotation of credentials.

Microsoft Certified:DevOps Engineer Expert

Domain 4Objective 1

Design and Implement Authentication and Authorization Methods AZ-400 Practice Questions (Page 3)

Part of the Develop a security and compliance plan domain, which makes up ~19% of our current practice bank. Microsoft does not publish an official question count, but from its 140-minute exam (~55–95 total, ~10–18 in this domain), expect 3–6 from this objective — we provide 26 practice questions to prepare you well beyond it. (estimate)

26questions here

6free pages

10concepts

Questions 11–15

11application · medium
Your GitHub repository has a workflow that needs to create issues in the repository. The workflow is triggered by pull requests from forks. What is the most secure way to authenticate the workflow?
Select an answer first
12application · medium
Your team uses GitHub Actions to deploy to Azure. The workflow needs to authenticate to Azure to create resources. You want to avoid storing long-lived secrets in GitHub. What should you use?
Select an answer first
13foundation · easy
Which Azure DevOps project configuration setting controls whether users can create new teams?
Select an answer first
14foundation · easy
Which statement correctly describes a system-assigned managed identity?
Select an answer first
15foundation · easy
Which GitHub authentication method is designed to provide fine-grained, installation-based access for an application and does not belong to a specific user?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AZ-400

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-400” is a trademark of its owner, used for identification only.

Design and Implement Authentication and Authorization Methods AZ-400 Practice Questions (Page 3)

Questions 11–15

Your GitHub repository has a workflow that needs to create issues in the repository. The workflow is triggered by pull requests from forks. What is the most secure way to authenticate the workflow?

Your team uses GitHub Actions to deploy to Azure. The workflow needs to authenticate to Azure to create resources. You want to avoid storing long-lived secrets in GitHub. What should you use?

Which Azure DevOps project configuration setting controls whether users can create new teams?

Which statement correctly describes a system-assigned managed identity?

Which GitHub authentication method is designed to provide fine-grained, installation-based access for an application and does not belong to a specific user?

Keep studying — Develop a security and compliance plan